WEBVTT 0:00:03.820000 --> 0:00:06.600000 Hello everyone and welcome. 0:00:06.600000 --> 0:00:13.700000 So in this video we're going to be exploring another technique in relation 0:00:13.700000 --> 0:00:17.040000 to testing for weak lockout mechanisms. 0:00:17.040000 --> 0:00:22.480000 So in the previous video we took a look at one of these lockout mechanisms 0:00:22.480000 --> 0:00:27.040000 in Autopi Passett, that being the basic arithmetic capture. 0:00:27.040000 --> 0:00:32.700000 We're now going to turn our attention to one of the more common lockout 0:00:32.700000 --> 0:00:38.180000 mechanisms, that being an account lockout and how to bypass it. 0:00:38.180000 --> 0:00:43.400000 So before we get into the practical demonstration you might be wondering 0:00:43.400000 --> 0:00:48.780000 what exactly an account lockout is and if I didn't mention it in the previous 0:00:48.780000 --> 0:00:53.220000 video already, an account lockout is very simple to understand. 0:00:53.220000 --> 0:00:58.700000 It's essentially a policy built into the authentication mechanism that 0:00:58.700000 --> 0:01:05.560000 essentially specifies and implements criteria for different types of situations 0:01:05.560000 --> 0:01:07.500000 pertinent to authentication. 0:01:07.500000 --> 0:01:08.600000 What does that mean? 0:01:08.600000 --> 0:01:14.020000 Simply put, it means when let's say, let's use one example, what should 0:01:14.020000 --> 0:01:21.740000 the web application do when there's been three or five or ten failed authentication 0:01:21.740000 --> 0:01:27.380000 attempts and in most cases there's what is typically done or the action 0:01:27.380000 --> 0:01:33.680000 taken by this particular mechanism is to lock that account. 0:01:33.680000 --> 0:01:35.240000 What does locking mean? 0:01:35.240000 --> 0:01:39.480000 Well locking means a couple of things but in essence it means that you 0:01:39.480000 --> 0:01:45.540000 can no longer log into that account and that account is considered locked 0:01:45.540000 --> 0:01:52.800000 and the lockout duration again is something that is unique to the web 0:01:52.800000 --> 0:01:59.820000 application and the policies, the policies that are actually enforced. 0:01:59.820000 --> 0:02:04.740000 So again there's different types of lockouts that could be, for example, 0:02:04.740000 --> 0:02:06.900000 15 minutes an hour, etc. 0:02:06.900000 --> 0:02:13.020000 Or there could be even some stricter ones that let's say require an administrator 0:02:13.020000 --> 0:02:19.120000 to actually manually explicitly unlock the account before you can use 0:02:19.120000 --> 0:02:26.080000 it. So how does this tie into this particular section and this particular 0:02:26.080000 --> 0:02:28.800000 test? Well it's very simple. 0:02:28.800000 --> 0:02:34.820000 Most modern web applications do have lockout mechanisms and we need to 0:02:34.820000 --> 0:02:35.860000 be able to test them. 0:02:35.860000 --> 0:02:39.360000 So in the previous videos it was a capture, we were able to bypass it 0:02:39.360000 --> 0:02:42.740000 and still perform our brute force and actually log in. 0:02:42.740000 --> 0:02:46.980000 In this case we're going to be again testing the authentication mechanism, 0:02:46.980000 --> 0:02:53.220000 so a login form and we're going to try and see whether there is a lockout 0:02:53.220000 --> 0:02:57.300000 mechanism in place which obviously there will be and we're going to try 0:02:57.300000 --> 0:03:00.840000 and enumerate and understand how it works and whether there's any rate 0:03:00.840000 --> 0:03:08.640000 limiting for the number of failed authentication attempts you can essentially 0:03:08.640000 --> 0:03:13.000000 provide a process or the web application can process. 0:03:13.000000 --> 0:03:17.180000 And this is important finally before you go into the practical demonstration. 0:03:17.180000 --> 0:03:21.220000 This is important because a brute force attack or a dictionary attack 0:03:21.220000 --> 0:03:26.020000 is an attack we are going to experience quite a few failed attempts and 0:03:26.020000 --> 0:03:30.560000 generally that's the easiest way of knowing if there is a lockout mechanism 0:03:30.560000 --> 0:03:35.060000 more specifically an account lockout. 0:03:35.060000 --> 0:03:39.620000 And with that being said we don't have anything theoretical to go through 0:03:39.620000 --> 0:03:46.540000 in this particular video so we are going to go through or I'm going to 0:03:46.540000 --> 0:03:51.300000 demonstrate what this looks like through the use of a practical lab. 0:03:51.300000 --> 0:03:58.280000 So this video has a lab associated with it. 0:03:58.280000 --> 0:03:58.480000 So I'm going to go through the lab and I'm going to show you a few examples 0:03:58.480000 --> 0:03:58.480000 of how to So I'm going to go through the lab and I'm going to show you 0:03:58.480000 --> 0:04:03.200000 a pre-configured calilinic system that we'll be using to facilitate our 0:04:03.200000 --> 0:04:07.060000 attacks. And so I'm going to fire up my lab and I'll see you there in 0:04:07.060000 --> 0:04:11.100000 a couple of seconds. 0:04:11.100000 --> 0:04:14.900000 All right so I'm currently within the lab environment and as you can see 0:04:14.900000 --> 0:04:17.720000 you'll have access to the calilinic system. 0:04:17.720000 --> 0:04:24.180000 Now in this particular lab the URL or domain of the target web application 0:04:24.180000 --> 0:04:28.960000 is just demo.ini.local so we don't need to play around with IPs or anything 0:04:28.960000 --> 0:04:32.500000 it's going to be the same for you in your lab unless explicitly stated 0:04:32.500000 --> 0:04:36.800000 within the lab documentation or stated differently. 0:04:36.800000 --> 0:04:43.000000 But for the most part demo.ini.local and during the first when you first 0:04:43.000000 --> 0:04:47.440000 start of the lab and you try and access demo.ini.local it's going to take 0:04:47.440000 --> 0:04:51.900000 one or two minutes for the web application to load up so do keep that 0:04:51.900000 --> 0:04:55.800000 in mind. There's nothing wrong with the lab in this particular case as 0:04:55.800000 --> 0:04:59.180000 you'll see the web application just takes a bit of time to start up so 0:04:59.180000 --> 0:05:00.860000 you can see it's still loading. 0:05:00.860000 --> 0:05:05.240000 Don't worry just give it one or two minutes max and you should be good. 0:05:05.240000 --> 0:05:09.880000 So I'm going to come back when my you know when this page is loaded and 0:05:09.880000 --> 0:05:13.880000 the web app is actually loaded so I'll see you in a few seconds. 0:05:13.880000 --> 0:05:19.980000 All right so the lab or the target web application is loaded and it looks 0:05:19.980000 --> 0:05:25.540000 like it is as you can see here it is a CMS or a content management system 0:05:25.540000 --> 0:05:36.500000 called Tiki Wiki and it looks like the default home page. 0:05:36.500000 --> 0:05:39.400000 If you're seeing this installation was completed really doesn't matter 0:05:39.400000 --> 0:05:45.720000 and you know it tells us to log in and there's a login button up here. 0:05:45.720000 --> 0:05:50.620000 We can we it doesn't really give us any you know it doesn't really give 0:05:50.620000 --> 0:05:56.760000 us any particular link to a login page but let's actually open up the 0:05:56.760000 --> 0:06:01.600000 source and look for the login here to see whether it actually has a link. 0:06:01.600000 --> 0:06:04.960000 I don't see any there we are so it's called Tiki login. 0:06:04.960000 --> 0:06:10.440000 So I'm going to open that up in a new tab and there we go we don't want 0:06:10.440000 --> 0:06:14.180000 to view the source in this particular case so I'm just going to get rid 0:06:14.180000 --> 0:06:17.320000 of that apologies let me use my keyboard much easier. 0:06:17.320000 --> 0:06:24.560000 So it's Tiki login dot php screen means the modal so we hit enter and 0:06:24.560000 --> 0:06:28.620000 there we are so we have you know this is now a real world web application 0:06:28.620000 --> 0:06:32.760000 nothing vulnerable or anything like that we have a username password combination 0:06:32.760000 --> 0:06:38.040000 or you know fields over here you can also click on I forgot my password 0:06:38.040000 --> 0:06:41.200000 so you can use your username or email. 0:06:41.200000 --> 0:06:44.820000 Let's try this out we're going to be testing for the admin account as 0:06:44.820000 --> 0:06:51.580000 per this labs there we are as per this labs documentation. 0:06:51.580000 --> 0:06:55.380000 Now we can see this is again another example of what I mentioned earlier 0:06:55.380000 --> 0:06:59.840000 on in this course regarding the verbosity of error messages or responses 0:06:59.840000 --> 0:07:04.760000 based on the type of data you specify so enter the admin user and based 0:07:04.760000 --> 0:07:08.600000 on this I'm able to confirm firstly that the user does exist but also 0:07:08.600000 --> 0:07:11.180000 that they haven't they don't have a configured email. 0:07:11.180000 --> 0:07:15.680000 Now if I you know typed in something that doesn't exist a user that doesn't 0:07:15.680000 --> 0:07:17.780000 exist let's see what happens now. 0:07:17.780000 --> 0:07:21.280000 So there we are it says invalid or no news name so this is actually proving 0:07:21.280000 --> 0:07:25.120000 that this user doesn't exist so this is part of what I was trying to explain 0:07:25.120000 --> 0:07:29.900000 or I did explain in the username enumeration video so hopefully that makes 0:07:29.900000 --> 0:07:33.800000 sense but this is not really what we're testing in this case I'm just 0:07:33.800000 --> 0:07:38.180000 going to reload my session looks like there's some cookies going on here 0:07:38.180000 --> 0:07:44.780000 let me just go back to login there we are and not login screen just ticky 0:07:44.780000 --> 0:07:50.260000 login.php does it redirect yes it does anyway so you know we are testing 0:07:50.260000 --> 0:07:54.680000 admin and if I put in admin and password let's see what happens here so 0:07:54.680000 --> 0:07:58.820000 invalid username or password in this case it's a bit less verbose because 0:07:58.820000 --> 0:08:03.160000 it doesn't tell us which of the two is incorrect but the forgot my password 0:08:03.160000 --> 0:08:23.140000 form does reveal or does allows to enumerate so I will use derb to perform 0:08:23.140000 --> 0:08:26.940000 directory and file brute forcing we know that the web application is you 0:08:26.940000 --> 0:08:36.660000 know using PHP back end so we'll say derb http demo.ini.local and before 0:08:36.660000 --> 0:08:41.220000 I do that let's see if we can find any text files that can maybe tell 0:08:41.220000 --> 0:08:46.880000 us the version of tickiwiki that's running here and then we can try and 0:08:46.880000 --> 0:08:50.620000 search for more in force to whether they are any authentication authenticated 0:08:50.620000 --> 0:08:55.600000 related authentication related vulnerabilities that affect this specific 0:08:55.600000 --> 0:09:00.540000 version so change log.txt is probably a good bet so let's go back to the 0:09:00.540000 --> 0:09:09.160000 home page and let's see if we can access change log.txt there we go and 0:09:09.160000 --> 0:09:14.820000 yes right over here we can see that this version is 21.1 so let's go ahead 0:09:14.820000 --> 0:09:20.480000 now into our terminal and I will use search exploit to search for exploit 0:09:20.480000 --> 0:09:24.120000 is a tool that allows you to query for exploit code within the exploit 0:09:24.120000 --> 0:09:30.800000 DB database so we'll just say tickiwiki and we want tickiwiki project 0:09:30.800000 --> 0:09:37.620000 21 sorry version 21.1 indeed we can see it here authentication bypass 0:09:37.620000 --> 0:09:43.440000 now the reason I did this was to highlight that there is you know this 0:09:43.440000 --> 0:09:46.900000 is considered authentication bypass but I think it's also a great way 0:09:46.900000 --> 0:09:51.460000 of showing you what rate limiting looks like so though this particular 0:09:51.460000 --> 0:09:58.620000 version of tickiwiki 21.1 has a has rate limiting enabled whereby if you 0:09:58.620000 --> 0:10:04.240000 try and log in or you provide in you know incorrect credentials 50 times 0:10:04.240000 --> 0:10:08.660000 or I should say more than 50 times the account gets locked and needs to 0:10:08.660000 --> 0:10:22.260000 be manually unlocked now and the weak account lockout mechanism because 0:10:22.260000 --> 0:10:28.020000 after those 50 attempts you can bypass authentication completely so you 0:10:28.020000 --> 0:10:33.120000 don't need to provide a password you just need to specify or provide an 0:10:33.120000 --> 0:10:37.900000 empty password and you'll bypass authentication so what we're going to 0:10:37.900000 --> 0:10:42.100000 do now is I'll go back to the login page let me close everything else 0:10:42.100000 --> 0:10:49.360000 here and I'll go into foxy proxy and just proxy the traffic to burp so 0:10:49.360000 --> 0:10:53.280000 there we all click on the burp profile I'll go into my menu web application 0:10:53.280000 --> 0:10:59.140000 analysis and burp suite and we'll give this a few seconds to start up 0:10:59.140000 --> 0:11:05.200000 and now we'll just say next start burp and yeah this seems to be a modern 0:11:05.200000 --> 0:11:08.080000 version of tickiwiki version so you can also use the burp proxy browser 0:11:08.080000 --> 0:11:13.320000 or the burp browser if you don't want to use foxy proxy there let me just 0:11:13.320000 --> 0:11:21.360000 get rid of that there we go and in here let me just let me just go into 0:11:21.360000 --> 0:11:26.980000 user I'm sorry not user options project options are sorry dashboard and 0:11:26.980000 --> 0:11:33.920000 can I see you know where are the options burp changes it's it's layout 0:11:33.920000 --> 0:11:38.400000 so many times but I'll increase the font size in a few seconds so burp 0:11:38.400000 --> 0:11:45.180000 we can actually just go to user options no project help can I increase 0:11:45.180000 --> 0:11:51.000000 the font size project options let's see user options display there we 0:11:51.000000 --> 0:11:55.100000 are my bad so I'm going to change this to something a little bit bigger 0:11:55.100000 --> 0:12:02.000000 so this is the hold on a second yeah so font size here will change this 0:12:02.000000 --> 0:12:07.020000 to 16 make that a little bit bigger and then the HTTP message display 0:12:07.020000 --> 0:12:12.280000 I'll change that to 18 so you can see that a little bit better all right 0:12:12.280000 --> 0:12:15.700000 so we'll go into proxy now and make sure intercept is on because we want 0:12:15.700000 --> 0:12:21.160000 to capture the test we want to capture request here so I'll just say admin 0:12:21.160000 --> 0:12:29.640000 let me for that there that's just Mozilla here in fact what I'll do let 0:12:29.640000 --> 0:12:34.440000 me just disable intercept here really quickly so I'll just disable and 0:12:34.440000 --> 0:12:41.020000 reload the page yeah go ahead and resend that okay no problem now I'll 0:12:41.020000 --> 0:12:47.480000 enable intercept and then in here I'll just say admin and admin the password 0:12:47.480000 --> 0:12:52.000000 isn't admin because we tested it so I'm just using this as test placeholders 0:12:52.000000 --> 0:12:58.560000 so there we are we can see that we have a cookie with a session ID obviously 0:12:58.560000 --> 0:13:04.100000 PHP JavaScript enabled and then we have the the actual body of the within 0:13:04.100000 --> 0:13:08.560000 the body of the request we have the parameters we also have a ticket user 0:13:08.560000 --> 0:13:12.900000 admin pass and then yeah all of the other parameters so we are going to 0:13:12.900000 --> 0:13:18.340000 send this to the intruder and over here under positions I'll just clear 0:13:18.340000 --> 0:13:22.080000 the default and we only want to test the password because we are testing 0:13:22.080000 --> 0:13:26.340000 we know that the admin user exists and that what that's what we're performing 0:13:26.340000 --> 0:13:29.680000 the dictionary attack or the user performing the dictionary attack on 0:13:29.680000 --> 0:13:34.600000 so I'll add this as a position the the value of the password parameter 0:13:34.600000 --> 0:13:38.700000 we don't need to modify anything else and then I'll go into payloads and 0:13:38.700000 --> 0:13:42.660000 we're going to use a dictionary or a word list that's stored on the desktop 0:13:42.660000 --> 0:13:46.720000 of the Kali Linux system under word lists and it's called a hundred common 0:13:46.720000 --> 0:13:53.300000 passwords and we can just hit start attack all right now what I want you 0:13:53.300000 --> 0:13:57.680000 to pay attention to is the length of the response here now it's going 0:13:57.680000 --> 0:14:02.180000 to change so these will obviously all fail and we can take a look at that 0:14:02.180000 --> 0:14:06.920000 in the response here if I go to where that's that's displayed let me see 0:14:06.920000 --> 0:14:10.820000 if I can find where the information is displayed there we are so invalid 0:14:10.820000 --> 0:14:15.680000 use name or password we're just going to wait for about 50 attempts incorrect 0:14:15.680000 --> 0:14:19.440000 attempts and you'll actually see that there will get a different message 0:14:19.440000 --> 0:14:23.700000 you know apart from invalid use name or password and that's going to be 0:14:23.700000 --> 0:14:27.180000 something pertinent or something like your account's been locked so I'll 0:14:27.180000 --> 0:14:32.560000 get back to you when I've crossed the 50 attempt threshold all right so 0:14:32.560000 --> 0:14:36.520000 we're about to cross the threshold and again I just want you to see what 0:14:36.520000 --> 0:14:42.560000 happens after 50 so we have 50 over here I'll just go to the response 0:14:42.560000 --> 0:14:48.860000 maybe around 130 line 130 of the response we should see the message so 0:14:48.860000 --> 0:14:52.860000 there we are error and the account requires administrator approval so 0:14:52.860000 --> 0:14:57.720000 that means it's locked and then all all consequent you know attempts to 0:14:57.720000 --> 0:15:01.640000 log in to that account regardless of whether using correct or incorrect 0:15:01.640000 --> 0:15:05.780000 credentials will all result in a response that has this so account requires 0:15:05.780000 --> 0:15:11.300000 administrator approval so now that we've locked the admin account I'm 0:15:11.300000 --> 0:15:15.480000 going to pause and stop the attack because this is now the authentication 0:15:15.480000 --> 0:15:21.780000 bypass attack so I've you know when testing for rate limiting or you know 0:15:21.780000 --> 0:15:25.340000 lockout mechanisms we've pretty much done that or you've been you've seen 0:15:25.340000 --> 0:15:30.140000 it you know essentially come to the for here and I think from request 0:15:30.140000 --> 0:15:34.860000 48 probably because we did do a few attempts manually but let's check 0:15:34.860000 --> 0:15:41.140000 this the response here yeah so from around 48 because we can see a change 0:15:41.140000 --> 0:15:45.280000 in the length of the response we know that the account was locked so at 0:15:45.280000 --> 0:15:48.700000 this point in time it's locked and can only be unlocked by the administrator 0:15:48.700000 --> 0:15:53.280000 so you know any consequent you know dictionary or brute force attacks 0:15:53.280000 --> 0:15:59.040000 will all fail or you know there's there's no way we can log in so at this 0:15:59.040000 --> 0:16:03.960000 point to bypass this or what the the you know this particular vulnerability 0:16:03.960000 --> 0:16:08.360000 is all about is the fact that as I mentioned if we go back to the proxy 0:16:08.360000 --> 0:16:12.840000 to our initial request that we send to the intruder we can now bypass 0:16:12.840000 --> 0:16:19.080000 the lockout as well as authentication completely by getting rid of the 0:16:19.080000 --> 0:16:23.220000 password value and the password value and just sending an empty password 0:16:23.220000 --> 0:16:29.280000 so we delete that and we hit forward and in this particular case we go 0:16:29.280000 --> 0:16:33.140000 back to the login page here I'm just going to go back into burp forward 0:16:33.140000 --> 0:16:40.800000 that as well forward forward there we go let's see there we go so we bypassed 0:16:40.800000 --> 0:16:46.140000 authentication completely as well as the weak account lockout mechanism 0:16:46.140000 --> 0:16:52.460000 and you can see we're logged in as admin so we can now we pretty much 0:16:52.460000 --> 0:16:57.220000 have full control over this sticky wiki content management system and 0:16:57.220000 --> 0:17:02.580000 actually I just want to show you something here we go to the control panels 0:17:02.580000 --> 0:17:11.280000 let me just disable intercept over here we'll give this a few seconds 0:17:11.280000 --> 0:17:15.200000 maybe it's going to not show if it's going to load but there should be 0:17:15.200000 --> 0:17:25.300000 a way for us to to actually unlock the so we go to over here so under 0:17:25.300000 --> 0:17:31.560000 access not groups my bad want to go into users so we'll give this a few 0:17:31.560000 --> 0:17:37.100000 seconds and we can see that admin right over here let's see if there's 0:17:37.100000 --> 0:17:45.620000 any information about the lock edit account settings over here and we 0:17:45.620000 --> 0:17:53.400000 can see right over here we can't so validate user but if we go into users 0:17:53.400000 --> 0:18:01.900000 actually all on settings action log may be under here we have anything 0:18:01.900000 --> 0:18:06.800000 on user lock here nothing there but again this is not really part of the 0:18:06.800000 --> 0:18:15.140000 demo I just wanted to see this let's see all nothing in their action so 0:18:15.140000 --> 0:18:26.120000 settings click on that here security admin let's see this here so security 0:18:26.120000 --> 0:18:35.900000 checks we can see this in here so there we are so extend login can really 0:18:35.900000 --> 0:18:42.420000 see anything useful there the sticky logs there we are so we can see that 0:18:42.420000 --> 0:18:49.360000 was a login mail error let's see can we we don't have anything else but 0:18:49.360000 --> 0:18:55.300000 the bottom line is we're able to you know bypass the lockout as well as 0:18:55.300000 --> 0:19:00.660000 authentication completely now we'll touch on authentication bypass or 0:19:00.660000 --> 0:19:06.880000 broken authentication in the next demo but yeah so I think it's a pretty 0:19:06.880000 --> 0:19:11.160000 interesting demo to sort of show you what this looks like and with that 0:19:11.160000 --> 0:19:15.060000 being said that brings us to the end of the practical demonstration section 0:19:15.060000 --> 0:19:20.420000 of this video all right so that was how to test for weak account lockout 0:19:20.420000 --> 0:19:25.600000 mechanisms specific to rate limiting or account lockouts and of course 0:19:25.600000 --> 0:19:29.380000 we also covered out to bypass them as well as another type of vulnerability 0:19:29.380000 --> 0:19:34.560000 which is authentication bypass or rather broken authentication so that 0:19:34.560000 --> 0:19:37.620000 being said that's going to be it for this video and I'll be seeing you